Subject: Re: namedroppers, continued

From: [email-masked]
Date: Mon, 02 Dec 2002 20:59:21 -0500

On Mon, 02 Dec 2002 14:33:16 PST, "Hallam-Baker, Phillip" said:

> If the spammer wants to perform custom operations for each 
> constituency they want to spam. 

No - you need a single custom cert/identity for each spamming run of several
million.  Unless you were *really* intending to cross-check the 3,000
spams they dropped on the IETF lists against the ones they sent to
yahoo.com's mailers, and the ones to AOL, and the ones to MSN, etc etc..

The worst part is that they would then present the *same* credentials to
the main IETF list and all the working groups.  This ends up leveraging one
of the strong points of digital signatures - if a signature is "well known"
because it's seen widely, it gets taken more seriously.  And there's no really
good way to tune this - I'm sure I post more to IETF lists than most spammers
do, so you can't even say "if they post more than X/day they're spammers"....

> I don't think they do, they have to be able to spam millions 
> of people at a time or the response rate is simply too low.
> Reported response rates are in the thousandths of a percent,
> so spamming the entire IETF gets less than a tenth of a customer.

But they got a tenth of a customer for *ONE* piece of outbound mail.
Which is an extraordinary response rate.
-- 
				Valdis Kletnieks
				Computer Systems Senior Engineer
				Virginia Tech

---

From: [email-masked]
Date: Mon, 02 Dec 2002 21:23:30 -0500

On Mon, 02 Dec 2002 14:33:16 PST, "Hallam-Baker, Phillip" said:

> OCSP scales fine for revocation checking. We can use the same
> platform that currently serves 6 billion DNS queries a day.

The fact that OCSP scales fine for revocation checking doesn't mean that
you have a system that scales fine for the *TOTAL PROCESS*.  Remember - the
tough part isn't checking the list - the tough part is getting entries
*INTO* the list in a secure manner.  Go back and re-read the issue at
http://www.cert.org/advisories/CA-2001-04.html and ask yourself if a CRL
would have been handled any differently.  Remember - it was a *process*
failure, not a software failure.

The DNS may answer 6 billion DNS queries a day.  But I can name some DNS
registrars that would take *MONTHS* to correctly transfer a domain. (The
continuing refrain for *years* on NANOG: "Has *anybody* ever gotten PGP auth to
work with these bozos?")

Also, there's the added issue that the DNS cuts down on traffic by way of
caching.  Unfortunately, that's the LAST thing you want a CRL to be doing
(in particular, negative caching is an extreme no-no). You can tell the ISP's
DNS server to cache the SOA and NS entries for amazon.com.  You can't tell
the ISP's OCSP server to cache the fact that there aren't any CRLs for
the SSL cert that www.amazon.com uses.

/Valdis

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Mon, 2 Dec 2002 14:33:16 -0800

> OK.. Almost plausible.  However note that currently, the PGP
> web-of-trust
> covers only a small percentage of the subscribers to the IETF
> list, and
> there's no *really* good PKI for S/MIME yet (hint - we don't
> seem to even
> understand how to apply 'basicConstraints', so if you think
> we're going to
> have working CRLs anytime soon, please share the name and
> address of your
> pharmaceutical supplier.. ;)

I don't have a pharmaceutical supplier at hand, however I can
provide you with the name of a company that has a nice line
in herbal viagra if you are interested.

> I propose to you that using a Thawte free S/MIME cert proves
> approximately
> zero - a spammer can just get one for each run (and remember
> that no matter
> how much a spammer tries to hid their identity, they *still*
> have to provide
> a working way to reach them (via smtp or http or whatever) or
> they don't get
> any feedback....)

		Phill